As I laid out in this previous blog post, I recently opted to setup a completely independent and self-managed PGP-infrastructure to replace the previous one managed by Proton Mail. So far, the thing has worked surprisingly well, and I've yet to figure out a reason not to keep maintaining this setup. I revently had a bit of a stumble though, and figured it would be worthy of a short post here.
Even though my public PGP-key is primarily used for email, there is technically nothing that prevents people from using it for other PGP-related duties. This isn't really a problem, but recently I ran into some issues with decryption when a friend of mine sent me a file encrypted with my public PGP key. It turned out that there is no built-in way to have Thunderbird decrypt attachments, even if it knows and fully controls the encryption key. I had to resort to exporting the key from Thunderbird, and using GnuPG to decrypt the file, which wasn't exactly difficult, but it was a bit annoying to have to spend an hour trying to figure that out. Thunderbird wasn't exactly helpful in its error messages. The lesson here is that you can't purely trust Thunderbird to handle all the PGP keys for you.
I even tried to simply point GnuPG to the Thunderbird directory where the keys are stored, only to be faced with a passphrase prompt. This is to be expected, apart from the fact that none of my passphrases used with Thunderbird worked. It turned out that this was and is actually a security feature within Thunderbird, explicitly developed to prevent this kind of behaviour. Thunderbird assigns each key it creates with a random passphrase, which is not accessible to the user, even if they know the Thunderbird master password. This means that even if some malicious actor gains access to the keys, they are useless as is without the random passphrase. Kinda neat, I guess. This was the reason as to why I had to export the keys, since this allowed me to assign them with a known passphrase. In the end everything worked out fine. The lesson in short is that if you lose your Thunderbird user profile, the keys themselves are useless even if you have them backed up.